Object-level authorisation
A user reaches an object that belongs to someone else.
home / services
service · API
API penetration testing: REST and GraphQL security
REST, GraphQL and other endpoints. We verify who can read and change what, with which tokens and with which limits.
what it covers
What we check in APIs.
Authentication and tokens
Reusable tokens, missing expiry, signatures not verified.
Exposed data
Responses with more fields than needed.
Mass assignment
Fields the client should not be able to set.
Rate limits
Operations that can be repeated without limits.
Undocumented endpoints
Active paths that do not appear in the documentation.
how we work
A fixed method, with a person at the end.
Mapping
If a specification is provided (for example OpenAPI), we use it as a map.
Hypotheses per role
For each pair of roles, the plan proposes requests to compare.
Controlled test
Requests logged one by one, using test tokens.
Review
A person verifies each vulnerability and assigns the severity.
Report
Request, response, impact and fix for each vulnerability.
included and not included
What you receive, and what is not in the service.
Included
- Report with reproducible requests and responses
- Matrix of the roles tested
- Severity assigned by a person
- Fix for every confirmed vulnerability
Not included
- Testing without a signed authorisation
- Denial-of-service testing
- Social engineering or physical attacks
- Testing of third-party systems
service sheet
To get started.
| Item | Detail |
|---|---|
| Type of test | Gray box with tokens for at least two roles |
| To start, we need | Specification or endpoint list, two roles, test environment |
| Delivery | Report, request log, role matrix |
| Price | from €2,000 to €4,000 |
Want to test the APIs of your product?
We reply by hand with a written proposal.